WO2010139650A2

WO2010139650A2 - Vehicle unit

Info

Publication number: WO2010139650A2
Application number: PCT/EP2010/057502
Authority: WO
Inventors: Ulrich STÄHLIN; Marc Menzel
Original assignee: Continental Teves Ag & Co. Ohg
Priority date: 2009-06-04
Filing date: 2010-05-28
Publication date: 2010-12-09
Also published as: EP2460338B1; US20120150392A1; CN102804734A; EP2460338A2; KR20120029460A; WO2010139650A3; KR101703500B1; DE102010029484A1; CN102804734B; US8554420B2

Abstract

The invention relates to a vehicle unit in a vehicle, comprising at least one multimedia control unit (3, 4) and at least one safety control unit (6) for controlling multimedia and safety functions, wherein the vehicle unit (1, 20) is provided as a switching unit between the multimedia control unit (3, 4) and the safety control unit (6), and wherein the switching unit (1, 20) processes the data received from the multimedia control unit (3, 4) and makes said data available to the safety control unit. The switching unit (1, 20) also transmits data received from the safety control unit (3, 4) to the multimedia control unit. Furthermore, the switching unit (1, 20) has a safety level which is higher than that of the multimedia control unit (3, 4) and lower than that the safety control unit (6).

Description

vehicle unit

The invention relates to a vehicle unit in a vehicle, in particular a vehicle unit integrated in a communication network with other vehicle units in the vehicle. The vehicle is equipped with at least one multimedia control unit, for example a multimedia ECU (Electronic Control Unit), and with at least one safety control device, for example a safety ECU, for controlling multimedia functions and safety functions. The proposed vehicle unit is provided as a switching unit between the multimedia control unit and the security control unit, wherein the switching unit or a computer provided in the switching unit is adapted to prepare data received from the multimedia control unit and to make it available to the security control unit.

For the purposes of this document, the term multimedia control unit should be broad and refer to all devices in the vehicle which are assigned the term "multimedia" or infotainment, in particular telematics applications (for example map displays, navigation system or the like), voice communication applications (mobile radio or mobile communications applications), consumer electronics (radio, television, video or the like) as well as data interfaces to user devices (Bluetooth, W-LAN or the like), the vehicle bring along and integrate into the vehicle electronics system. These applications have in common that they do not assume any safety-relevant functions in the vehicle.

Such safety-related functions are reserved for safety control devices, which include, in particular, driver assistance systems that detect (hazard) vehicle sensors (environmental dynamics sensors), environment sensors (sensors surrounding the vehicle) or vehicle-to-vehicle or vehicle-to-vehicle communication (C2C resp. C2X communication), wherein the C2X communication comprises the C2C communication as a special case, actively intervene in the control of the vehicle, for example by emergency braking. Examples include ADAS (Advanced Driver Assistance System) or ESC (Electronic Stability Control).

Heretofore, the systems in the vehicle have been isolated in systems with high safety requirements, ie systems that are necessary for the safe operation of the vehicle or increase the safety of the driver, and those systems that serve the entertainment and information of the driver, such as Navigation systems or radio units. This distinction results from the different demands on the reliability of multimedia systems and security systems. Security units participating in the security systems are being developed "safety-driven", whereas multimedia units of the multimedia systems have to keep up with the development of consumer electronics and are therefore to be developed "feature-driven". The feature-driven multimedia units have a variety of features that are designed to be quickly integrated into the vehicle units, but in the event of operating errors or in certain situations they may cause malfunctions and system crashes, which must then be re-established. This is not dramatic in multimedia features, as they merely serve to entertain and inform the driver, so rebooting or malfunctioning has no impact on vehicle safety.

On the other hand, safety units that directly affect safety-related vehicle functions or inform drivers about safety risks have a direct impact on road safety. Therefore, there are much higher demands on the reliability and stability of these systems. These develop much slower and are so robust that they usually do not fail and possibly even by redundancies provided to cope with the failure of some electronic components.

The development of such security units is very expensive for this reason, so that the two worlds in vehicle electronics are usually kept separate. Sometimes it is possible to establish communication between the two worlds via a vehicle communication network, which then does not have to meet the high safety requirements. However, in connecting the two worlds and sharing information across those system boundaries, the various basic requirements "feature driven" vs. "safety driven" is a problem because a security system is developed much more slowly and a multimedia unit due to the fast development cycles no focus on compliance with safety criteria, for example, according to IEC 61508 or the analog Automotive Standard must lay. These systems continue to evolve much faster, so that there are always difficulties in the communication interfaces between these two problems.

WO 2009/101163 A2 discloses a vehicle system for navigation and driver assistance with a navigation unit, a provider unit, a sensor unit and a driving assistance system, in which the navigation unit, as part of a multimedia control unit, supplies map sections of the map environment to a provider unit which communicates these data adjusts further sensor or other information and generates an environment map of the vehicle, which is used by the driver assistance system to respond properly in dangerous situations. This system runs under the keyword "assistance horizon" and is used eg in the ADAS system as eHORIZON. While the navigation unit is being developed as a multimedia unit with only low security requirements, it is desirable for the provider unit as the horizon for the driver assistance system providing unit that this unit has a high security level, so that in the interface between the navigation unit and the provider unit of Transition from a "feature driven" developed system to a "safety driven" developed system takes place and the provider unit is a correspondingly high-quality and expensive unit. The problem in this context is that the multimedia control units evolve rapidly and, if necessary, interfaces and functions to the provider unit are no longer interchangeable. This requires a redesign of the provider unit, which, however, is slower and much more expensive, since the interface itself must meet the high security requirements again.

The object of the present invention is to provide a more flexible interface between the multimedia control units and the security control units in a vehicle.

This object is achieved with the features of claim 1. It is provided that the switching unit proposed according to the invention is also adapted to pass on data received from the security control unit to the multimedia control unit (in the sense of a bidirectionally communicating switching unit), which allows a bidirectional communication flow in a simple manner, without the security control unit itself being connected to a Interface of a multimedia control unit with a lower security level must be connected. Furthermore, the switching unit is characterized according to the invention in that the switching unit achieves a higher security level than in the case of the multimedia control unit and a lower security level than in the security control unit, so that the switching unit is in the production and development is more cost-effective and can be adapted more quickly to changing requirements of the "feature-driven" multimedia control units without having to adapt the high-security-relevant security control units. This switching unit thus combines the two worlds of "feature-driven" and "safety-driven" and thus acts as an intermediary between the multimedia world and the security world.

The switching unit can be designed as one or more electronic control units (ECU), which does not have the same safety requirements (SIL - Safety Integrity Level) of the safety world, but has a significantly higher SIL classification than the multimedia world. This intermediate security level already allows a real-time capability of the switching unit as well as a certification of the software and a complete system monitoring. This avoids catastrophic failures that may affect the function of the safety devices. However, the performance of this switching unit is reduced compared to the multimedia units, which is due to the higher system security.

In order to achieve this average security level between the higher security level of the security control unit and the lower security level of the multimedia control unit, provision may be made, in particular, for the switching unit to be set up, in particular to continuously perform system monitoring. This can be designed so that the switching unit in the error lerfall outputs an error message, which notifies both the user and the safety devices of the malfunction, so that both the driver and the safety devices can adjust to the lack of information provided, and possibly restarted.

According to a further development of the proposed vehicle unit, the switching unit for connection to the various other vehicle units may have at least one connection for a multimedia control unit and at least one connection for a safety control unit. The connections can then in particular have different security levels, preferably in each case the security level of the connected unit.

In this case, it is according to the invention z. For example, it is possible to make the connections to the multimedia control unit configurable, so that they can be easily adapted to different multimedia control units or newer device generations.

For this purpose, it is particularly advantageous according to the invention if the switching unit has a plurality of arithmetic units, of which one arithmetic unit serves the configuration of the interface and is set up such that it provides a precisely defined standard at an internal interface independently of the external interface to the multimedia control unit. which can be queried by the other arithmetic unit in a closed system with the security level of the switching unit. As a result, a configurable first interface is easily achieved without having to intervene in the system of the second interface to the security control units. The first computing unit of the switching unit can therefore also have a lower security level than the second or further computing units of the switching unit, so that configuration interventions by the user or workshops that connect new devices can be allowed. In such a system, the system monitoring of the switching unit is preferably integrated into the computing unit with the higher security level, so that errors in the configuration of the first processing unit with a lower security level can be reliably detected and reported.

According to a further embodiment of the vehicle unit, the switching unit, in the case of a plurality of arithmetic units having a different security level, the arithmetic unit having the security level of the switching unit, can be set up to preprocess the data for a direct bidirectional ad hoc network.

Radio communication, positioning (position detection) based on satellite position data, map data, vehicle-to-environment communication data (including vehicle-to-vehicle communication), vehicle sensor data and / or environmental sensor data, and a vehicle Determination of the expected road and traffic development (environment representation).

The determination of the expected road and traffic can be an eHORIZON forecast or just a preparatory tion of this forecast in terms of a provided map of the environment of the vehicle. A preprocessing of the data for the bidirectional ad hoc network radio communication can in particular mean a preparation of the data in the context of the ITS standard for a DSRC or ITS G5 radio communication, wherein all the ITS layers or only the content preparation the data corresponding ITS layer can be processed in the arithmetic unit of the switching unit. Further information on the standards of the various ITS layers can be found on the Internet at "www.standards.its.dot.gov", so that at this point, the nature of the DSRC or ITS G5 communication according to the ITS is not specified Standard (ITS - Intelligent Transportation System).

Vehicle sensors are preferably those sensors that detect a state of the vehicle or a state of vehicle parts, in particular their state of motion. These may include odometer sensors, speed sensors, steering wheel angle sensors, speed sensors, yaw rate sensors and the like. be. Under environmental sensors, the font understands such sensors that detect the environment of the vehicle, the environmental sensors are mounted on the vehicle and self-sufficient, d. H. without information signals from the outside, objects or states in the environment of the vehicle capture. These include in particular cameras, radar sensors, lidar sensors, ultrasonic sensors or the like.

For vehicle-to-vehicle communication or vehicle-to-environment communication, the DSRC or ITS-G5 system according to the ITS standard is preferably used. According to the invention, the switching unit can be integrated in a housing. However, according to the present invention, a switching unit can also be divided into a plurality of modular units, wherein preferably each of the modular units has its own arithmetic unit. In this case, each of these module units has a higher security level than the multimedia control unit and a lower security level than the security control unit. In this case, all module units of the switching unit can preferably have the same security level. However, it is also possible to design the security levels differently according to the functions adopted. This offers z. For example, if individual module units are provided with connections to multimedia control units and other module units to take over functions and possibly other module units for safety control units. The provision of various module units is not limited to each module unit having its own housing. It is also possible according to the invention to provide different module units in a common housing, wherein the module units are preferably logically separated in this case, so that the individual module units are simply separately exchangeable and internal, preferably standardized interfaces are formed between the module units.

In this case, it is particularly advantageous if the plurality of module units of the switching unit each have connections for connection to other module units of the switching unit, which preferably have the security level of the respective module units correspond, with different module units preferably the highest security level is selected. These connections make it possible in a particularly simple way to exchange the module units designed as plug-in cards, for example.

According to a further preferred embodiment, it makes sense to integrate a mobile radio unit with an emergency call unit into the switching unit, since it is desirable to operate an emergency call unit with an increased security level, so that this telematics function is integrated into the switching unit with the higher security level compared to multimedia control units can. Furthermore, the switching unit can be set up to generate an environment representation in the sense of an environment map of the vehicle, which can be used, for example, as horizon (eHORIZON) for driver assistance systems (eg ADAS - Advanced Driver Assistance System).

Further advantages, features and embodiments of the present invention will become apparent from the following description of exemplary embodiments and the drawings. All described and / or illustrated features alone or in any combination form the subject matter of the present invention, also independent of their summary in the claims or their back references.

Show it: Fig. 1 shows schematically a switching unit according to the invention in a vehicle network according to a first embodiment and

2 shows schematically a switching unit according to the invention in a vehicle network according to a second embodiment.

FIG. 1 illustrates a vehicle unit 1 according to the invention designed as a switching unit, which is located in a vehicle with at least one multimedia control unit 2, 3, 4. The multimedia control unit 2 is designed as a radio and entertainment unit. The multimedia control unit 3 represents a telematics / navigation unit, and the multimedia control unit 4 is an intelligent antenna through which cellular mobile radio communication, satellite communication, and vehicle-to-vehicle communication are performed can. For the vehicle-to-vehicle or vehicle-to-environment communication, the designation C2X communication is also chosen below, which is preferably carried out according to the ITS standard by means of DSRC or ITS-G5 communication. As a further unit, a vehicle sensor and / or environment sensor unit 5 is present.

Furthermore, the vehicle is equipped with a safety control device 6, which can be designed as a driver assistance system, for example ADAS - Advanced Driver Assistance System. The multimedia control units 2, 3, 4 have a substantially lower safety standard than the si- safety control unit 6, which is reflected in different safety levels of the SIL level (Safety Integrity Level).

The reason for this is the different development of the different units. The multimedia control units are designed to quickly integrate new features available on the market. This "feature-driven" development requires that the integration of new features into the devices under certain application conditions can result in failures that cause the applications to fail and may even require a restart of the applications to resume their functionality. This is unacceptable in safety control devices that directly affect the safety of the vehicle and, for example, driver assistance functions. Therefore, these safety control units have a much higher SIL level. These security control units 6 are developed "securitely driven", i. H. the development has been done so carefully and the electronic elements used in the units are so reliable that failure of the system is extremely unlikely. This development requires new features to be incorporated into this unit very slowly and after extensive testing so that the development speeds for the two systems diverge. This makes it difficult to connect these two systems in the vehicle.

Nevertheless, it is desirable to connect multimedia control units 2, 3, 4 and security control units 6 in the vehicle system and, for example, to exchange information. For this the invention proposes the switching unit 1, to which the multimedia control units 2, 3, 4, the safety control unit 6 and the vehicle sensor and / or environment sensor unit 5 are connected. The latter may have a higher or a lower SIL level depending on the quality and design.

For connection to the switching unit, terminals 7 with a low security level are provided for connecting the multimedia control units 2 to 4 and the vehicle sensor and surroundings sensor unit 5, the invention not being restricted to the units specifically mentioned, as by the free terminal 7 in FIG indicated.

On the other hand, the security control unit 6 is connected to the switching unit 8 via a connection 8 with a high security level, it also being possible here to provide further connections 8 for connection to further security control units.

Both the connections 7 with a low security level and the connections 8 with a high security level are connected to a computing unit 9 of the switching unit 1. However, the connections 7 with a high security level and the connections 8 with a high security level differ, for example, in that the connections 7 can be configured by the computing units 9 and adapted to the respective connected multimedia control unit 2 to 4 or vehicle sensor or environment sensor unit 5 or the electronic components used are cheaper. Terminal 8 with a high level of security is not easily configurable and already meets the high security requirements of the safety control unit 6 according to their security level. This makes it clear that the switching unit 1 is intended to connect the multimedia control units 2 to 4 and the security control units 6 with their different security levels or generally vehicle units of different security levels, to each other and to allow flexible communication between these units.

In addition to producing such a data exchange in both directions connections between the units 2, 3, 4, 5 with low security level and the units 6 with high security level, the arithmetic unit 9 of the exchange unit 1 can also be set up to perform certain tasks. In this context, an environment representation 10, a positioning 11 and a communication preprocessing 12 are shown here by way of example, without the invention being restricted to tasks implemented in a particularly advantageous manner in the switching unit. The environment representation 10 is used to map the current environment of the vehicle by means of a map or horizon, which can be used as an input of the safety control devices 6, so that a driver assistance system 6 knows the environment of the vehicle and react in dangerous situations adapted to the environment of the vehicle can. A well-known application for this is eHORIZON in conjunction with the ADAS driver assistance system. The mode of operation of such an environment representation is disclosed in WO 2009/101163, so that further explanations on this are dispensed with. Another task which the arithmetic unit 9 of the exchange unit 1 can assume is a positioning 11 based on satellite signals, for example GPS, map information, C2X communication and vehicle and / or environment sensors. In the meantime various techniques can be used to determine the position of the own vehicle, which can replace or improve the satellite positioning. The aim is therefore to combine all the methods for positioning in the switching unit and to provide the vehicle with a uniform, as accurate as possible position, which can be transmitted both to multimedia control units 2 and to security control units 6. Possible techniques for the positioning are GPS, Gallileo or other satellite-based positioning systems, positioning via WLAN, positioning via mobile radio, map data, vehicle sensors, such as wheel speed sensors, steering wheel angle sensors, yaw rate sensors, as well as environment sensors, such as cameras of a subsequent Trianggulations- or landmark evaluation , Transponders, etc., although some of the aforementioned techniques can only be used as a support and do not allow complete positioning of the vehicle.

This application is particularly advantageous because all or as many vehicle units are connected to the exchange unit 1, so that a communication via the exchange unit can be done easily and there are all data and information available. Of course, it is not excluded that the individual multimedia control units 2 to 4 or sensor units 5 communicate with each other via a vehicle communication network 13 and bypassing the switching unit 1.

Another useful application in the arithmetic unit 9 of the switching unit 1 is a preprocessing of C2X information, in particular in the context of the ITS standard (Intelligent Transportation System). The goal is to consolidate the data received, extract relevant objects and events, validate data, generate or identify metadata for fusion with environmental sensors, select and bridge gaps in reception, and address privacy issues, such as: B. by an ID change to compensate.

The switching unit 1 can perform the tasks 10 to 12 all or even perform individual tasks or only allow communication between vehicle units with different levels of security in a bidirectional way, so that the multimedia control units 2, 3, 4 or similar units, such as sensor units , Data to the security units 6 can send and data from the security control units 6 can also be displayed or verwedet in multimedia control units 2 to 5.

Therefore, it is also possible, as a switching unit 1, for example, to equip a unit for the environment representation 10 with the corresponding terminals 7, 8 and possibly further tasks such as the positioning 11 and the communication preprocessing 12 into the unit for the environment representation 10 so that this unit can operate as a switching unit 1 according to the present invention.

The same is also possible for a telematics unit, in particular an emergency call unit, which should preferably also operate at a higher security level than a conventional multimedia control unit 2, so that this unit can form the switching unit 1 according to the invention particularly advantageously. A vehicle sensor or environment sensor unit 5 also frequently operates at a higher security level than a pure multimedia control unit 2, since the data of the sensors connected to the sensor unit 5 are frequently to be relayed by safety control units 6. Therefore, the inventive switching unit 1 could also be integrated into such a sensor cluster 5.

FIG. 2 shows an alternative embodiment of a switching unit 20, whose basic function, however, corresponds to that of the switching unit 1 and will therefore not be described in detail below. The same reference numerals as in FIG. 1 are used for the same functions or connected units.

However, the switching unit 20 is modular and has three different modules. A first module is a connection module 21 with terminals 7 with a low security level. The second module is a functional module for performing certain tasks, and the third module is a connection module 23 with high-security connectors 8. All modules 21, 22, 23 of the exchange Unit 20 are connected to each other via an internal interface 24 and each have a computing unit 25, 26 and 27. The arithmetic units 25 and 27 of the connection modules 21 and 23 are each designed to address the terminals 7 with lower or the terminals 8 with a high security level, wherein the arithmetic unit 25 in particular allows a configuration of the terminals 7. Because of this configuration option, the connection module 21 has a lower security level than the function module 22 and the connection module 23, which according to the invention have the same security level. However, the connection module 21 preferably has a higher security level than the multimedia control units 2 to 4. The security level of the function module 22 and preferably also of the connection module 23 are below the security level of the security control units 6. Since the vehicle sensor and / or environment sensor unit 5 according to FIG. 2 has a higher security level than in FIG. 1, this is directly connected to a connection 8 connected with high security level in the connection module 23, wherein the sensor data can be exchanged via the internal interface 24 between the various modules 21, 22, 23 of the exchange unit 2 and each bidirectional output via all ports 7, 8.

In a computing unit 26, the function module 22 comprises the tasks environment representation 10, positioning 11 and communication preprocessing 12, as well as possibly additional tasks, such as, in particular, the communication connection of vehicles. units of different security levels to each other.

LIST OF REFERENCE NUMBERS

1 exchange unit

2 multimedia control unit, radio and entertainment unit

3 multimedia control unit, telematics or navigation unit

4 multimedia control unit, antenna unit

5 vehicle sensor and / or environment sensor unit

6 safety control unit, driver assistance system

7 Connection with low security level

8 Connection with high security level

9 arithmetic unit

10 environment representation

11 positioning

12 communication pre-processing

13 vehicle communication network

20 switching unit

21 Connection module with connections 7

22 function module

23 connection module with connections 8

24 internal interface, connection

25 arithmetic unit

26 arithmetic unit

27 arithmetic unit

Claims

Claims:

A vehicle unit in a vehicle having at least one multimedia control unit (3, 4) and at least one safety control unit (6) for controlling multimedia functions and safety functions, the vehicle unit (1, 20) acting as a switching unit between the multimedia control unit (3, 4) and the Security control unit (6) is provided and wherein the switching unit (1, 20) of the multimedia control unit (3, 4) prepared data and the security control unit provides, characterized in that the switching unit (1, 20) from the security control unit (3 , 4) forwards received data to the multimedia control unit and that the switching unit (1, 20) has a higher security level than the multimedia control unit

(3, 4) and has a lower security level than the security control unit (6).

2. Vehicle unit according to claim 1, characterized in that a system monitoring of the switching unit (1) takes place.

3. Vehicle unit according to claim 1 or 2, characterized in that the switching unit (1, 20) at least one connection (7) for a multimedia control unit (3, 4) and at least one connection (8) for a safety control unit (6), which have different security levels.

4. Vehicle unit according to one of the preceding claims, characterized in that the switching unit (1, 20) preprocessing the data (12) for bidirectional ad hoc network radio communication, positioning (11) on the basis of satellite position data, map data, vehicle to environment communication data, vehicle sensor data and / or environment sensor data and / or an environment representation (10) to determine the expected road and traffic course performs.

5. Vehicle unit according to one of the preceding claims, characterized in that the switching unit (20) to a plurality of modular units (21, 22, 23) is divided.

6. Vehicle unit according to claim 5, characterized in that the module units (21, 22, 23) of the switching unit terminals (24) for connection to the other module units (21, 22, 23) of the switching unit (1).

7. Vehicle unit according to one of the preceding claims, characterized in that in the switching unit (1, 20) a mobile radio unit is integrated with an emergency call unit.